Critical PHP vulnerabilities: PowerFolder is not affected

On 21 October 2026 the PHP project published an advisory about two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619 can allow remote code execution without authentication. Every PHP installation serving web requests is affected. PowerFolder is not.

The original advisory on php.net →

Why not? PowerFolder contains no PHP. The server, the clients and the web interface are written in Java, and this website does without PHP as well — it consists of static files. There is no place in our product where these flaws could take hold, so your PowerFolder installation needs no action.

Worth a look anyway: if anything else runs on the same server — a CMS, a webmail front end, a ticket system, a monitoring interface — the advisory applies there. According to the PHP project all common deployment modes are affected, from PHP-FPM through php-cgi to FrankenPHP and LiteSpeed; the risk is highest with Apache and mod_php.

Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source backports exist for 7.4, 8.0 and 8.1, which are no longer regularly maintained. Distributions received the patches in advance, so your package sources are the first place to look. The project states there is no complete mitigation short of updating — the partial measures going around are not enough.

Not sure whether your environment is affected? Talk to us →